generate-youtube-thumbnail
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied assets, such as brand logos and character photos, as well as text prompts for generation.\n
- Ingestion points: Reference images in the
references/directory and prompt strings configured in thescripts/generate-batch.shscript.\n - Boundary markers: While the script does not implement technical boundary markers, the documentation provides templates and a 'CRITICAL CHARACTER LIKENESS' block to guide the model's interpretation of external data.\n
- Capability inventory: The script utilizes
curlfor network interactions andpython3for image processing and JSON data handling.\n - Sanitization: The implementation uses
shlex.quoteto sanitize dynamic headers retrieved from the API before they are used in a shellevalcontext, mitigating command injection risks.\n- [DYNAMIC_EXECUTION]: Thescripts/generate-batch.shscript usesevalto construct and executecurlcommands for image uploads, using dynamic headers provided by the Novoads API. It also executes embedded Python logic at runtime to perform image resizing (via Pillow) and to process JSON payloads.
Audit Metadata